Popcorn Time is Vulnerable to Significant Hack Attacks

Popular file sharing and streaming service Popcorn Time contains critical vulnerabilities leaving it open to XSS attacks, files being read locally and remote code execution attacks, according to a security researcher.

The security researcher has discovered significant vulnerabilities within the popular file streaming service Popcorn Time, potentially allowing attackers to gain complete access and control of a computer connected to the service. The researcher made a comprehensive account of his findings in a blog post.

Popcorn Time has always been a target among anti-privacy companies and the MPAA (Motion Picture Association of America) and now finds itself under threat from a different adversary.

The Vulnerability

Antonios Chariton, aka ‘DaKnOb’, the researcher who discovered the vulnerability, claims to be a security engineer and researcher studying in Greece for his B.Sc. in Computer Science.

“There are two reasons that made me look into Popcorn Time,” said Chariton.

First of all, I know many people who have installed this application on their personal computers and use it, and second of all, by pure accident: I was setting up my computer firewall when I noticed the network traffic initiated by Popcorn Time.

The engineering student notes that initial concerns aside, problems really flare up when Popcorn Time initiates a “really smart” process and technique to bypass the blockades set by ISPs (Internet Service Providers) in the UK. The popular streaming service manages to do this by using the CloudFlare infrastructure as a part of its setup and connectivity process. Due to this, ISPs find it nearly impossible to block Popcorn Time purely by means of a DNS address without banning the CloudFlare website entirely.

Despite being clever in its maneuvering around the blockade, the problems coming from such a move are clear.

“First of all, the request to Cloudflare is initiated over plain HTTP. That means both the request and the response can be changed by someone with a Man in the Middle position (Local Attacker, Network Administrator, ISP, Government, etc.),” explains Charlton.

The second mistake is that there is no input sanitization whatsoever. That means, there are no checks in place to ensure the validity of the data received. The third mistake is that they make the previous two mistakes in a NodeJS application.

Furthermore, Chariton was able to engineer and initiate “content spoofing” attack which enabled him to change the title of a movie. Case in point, he gave the movie Hot Pursuit the title of “Hello World” instead.

(Image credit: Daknob Blog)

It was at this point in time that Chariton launched an XSS attack. By injecting malicious JavaScript, the Popcorn Time client executed the code which gave him complete control of the application. He was only getting started, however.

“This essentially is Remote Code Execution on the computer that runs Popcorn Time. You can do anything the computer user could do.”

Image from PopcornTime Website and Wikipedia.

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way. (0 votes, average: 0.00 out of 5)You need to be a registered member to rate this.Loading...

Ali is a freelance journalist, having 5 years of experience in web journalism and marketing. He contributes to various online publications. With a master degree, now he combines his passions for writing about internet security and technology. When he is not working, he loves traveling and playing games.

1 Comment

Charles Hebdo

August 16, 2015 at 8:27 am

Well into a PopcornTime session today, my computer sounded 3 alerts, and a few seconds later, a private excel file popped open, by itself. I was naturally alarmed, so I proceeded to close my network connection, and check the event log. Noticed an odd SYSTEM logon event dated a few minutes before the incident. A google update error also showed up. No VNC or similar remote-in software running. Popcorntime Desktop service was the only suspicious thing running…

Leave a Reply

NEM Theft Suggests Hacking Is More Lucrative than Mining

The NEM Foundation has called off its search for the 523 million NEM tokens that were stolen from the Tokyo-based Coincheck exchange. Although the Foundation lauded the effectiveness of the search, the outcome proves yet again that cryptocurrency hackers are benefiting from the dark web, which provides an effective venue for laundering stolen funds.

Search for Stolen Coins Ends

In a statement published Mar. 19, the NEM Foundation informed its community that it had disabled the tracking mosaic used to monitor the movement of XEM funds tied to the massive heist of Coincheck in January. According to the post, the search ended on Mar. 18.

The statement reads:

“Beginning March 18, the NEM.io Foundation has disabled the tracking mosaic that was put into place to monitor XEM movements from the Coincheck theft. This effort was effective at reducing the hacker’s ability to liquidate stolen XEM and provided law enforcement with actionable information. We don’t plan to release further details due to the sensitive nature of this investigation.”

On. Jan. 26, hackers successfully made off with $530 million worth of XEM tokens, marking the biggest crypto heist on record. The theft propagated a new investigation into existing crypto exchanges by Japan’s Financial Services Authority (FSA). Domestic exchanges also announced plans to form a self-governing body to safeguard against illicit activity.

Hacked reported earlier this month that the Coincheck attackers had already laundered some 40% of the stolen NEM funds, primarily through the dark web. The stolen coins have reportedly made their way into exchanges in Japan, China and Canada.

Crypto Heists: A Growing Phenomenon

While the crypto economy has been highly lucrative for early adopters, cyber criminals have managed to steal huge sums of money. Unlike credit card fraud, the theft of major crypto exchanges has reshaped the digital currency market. This was most evident in 2014, when Mt Gox fell prey to a $480 million attack that eventually led to its demise.

As the Coincheck hack demonstrated, locating stolen funds and identifying perpetrators are extremely difficult. That said, NEM’s efforts to blacklist the tokens probably limited how much money the attackers were able to keep.

This brings us to an important question: is hacking more lucrative than legitimate crypto mining? To answer that question, we’ll begin by providing a rundown of the major crypto heists of the last four years.

Since 2014, hackers have made off with more than $1.3 billion in stolen coins. The biggest losses are as follows:

Coincheck: $530 million (2018)

Mt Gox: $480 million (2014)

Parity Wallet: $155 million (2017)

Bitfinex: $65 million (2016)

NiceHash: $63 million (2017)

DAO: $50 million (2016)

Tether: $31 million (2017)

For all of 2017, it is estimated that hackers stole nearly $400 million from ICOs. That’s roughly 10% of the total amount raised for the year.

Mining Profitability

Cryptocurrency mining has spearheaded a multi-billion-dollar industry. The recent crackdown on mining rigs in China means there is a large void in the market that several jurisdictions, including Canada and India, are rushing to fill. During the height of bitcoin’s surge, crypto miners earned roughly $240,000 every ten minutes. Miners now earn roughly half that, based on current price levels.

Of course, this doesn’t factor the cost of electricity, power consumption, hardware, manpower and other fees needed to operate a mining operation. These variables, combined with the unknown trajectory of crypto prices, make profitability a lot harder to gauge.

The yearly decline in profitability is also a critical, albeit elusive variable in pricing the success of a mining operation. This variable is tied to the number of miners that join the network – a figure that is extremely difficult to predict. Against this backdrop, 99bitcoins.com has developed a bitcoin mining calculator that provides simple guidance on whether a certain mining operation is profitable.

Other digital currencies provide a potentially more lucrative opportunity to join the mining business. For example, Monero can still be mined with a basic desktop computer. With an average block time of two minutes, users can mine the coin casually using the spare computing power of their home PC.

However, it appears that hackers have already taken over the Monero mining business. There are several recent cases of hackers embedding malware to hijack the computing power of other systems. The Australian government was also a victim of this hacking attempt.

Cryptomining is such a new phenomenon that there are few guidelines in place to ensure trust. Selecting a company to work with an a fair compensation model are two important questions every potential miner needs to consider.

As cryptocurrencies appreciate in value, the allure of cyber crime will continue to grow. As NEM, Mt Gox and other large-scale thefts demonstrate, criminals are succeeding in their quest to compromise online exchanges.

With respect to mining, profitability remains an elusive question, especially with the recent downturn in the market. That said, there are many alternative motivations involved in mining digital currency, including supporting the network, influencing the market and using additional revenues to fund other business operations.

Disclaimer: The author owns bitcoin, Ethereum and other cryptocurrencies. He holds investment positions in the coins, but does not engage in short-term or day-trading.

Featured image courtesy of Shutterstock.

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way. (6 votes, average: 4.00 out of 5)You need to be a registered member to rate this.Loading...

4.5 stars on average, based on 410 rated postsSam Bourgi is Chief Editor to Hacked.com, where he specializes in cryptocurrency, economics and the broader financial markets. Sam has nearly eight years of progressive experience as an analyst, writer and financial market commentator where he has contributed to the world's foremost newscasts.

Spectre And Meltdown Madness: What It Means For Ethereum

To anyone who talks in terms of a cryptocurrency bubble, consider the following fun facts. In the short period of a few days following the bombshell announcement of Meltdown and Spectre, crypto prices responded in the following manner:

In my view, this is clear evidence of a market that is responding rationally to information coming from responsible sources. To appreciate what all the noise is about you must appreciate what Meltdown and Spectre are and why they present a danger to the big companies providing cloud storage for the corporate world.

Once this is clear, then you will better appreciate why Ether’s 41%+ short-term price spike left the others in the dust. But first lets dig into the Meltdown and Spectre situation.

The Secret Got Out

On January 3 the secret about a new class of security vulnerabilities leaked out to the public. Not only was this seriously bad news but the leak also gave hackers advanced notice before anyone could begin to fix the twin problems.

The degree of seriousness is in the fact that almost all major microprocessor chips are vulnerable. This opens the door to hackers stealing information from personal as well as cloud services.

Researchers claim that Meltdown can be fixed with a patch. Shortly thereafter about every major player announced their patch. But there are two issues here. Will the patches fully solve they problem?

Casting A Cloud Over The Cloud

When a corporation becomes a cloud customer, even the largest share machines with other customers. This is the basic flaw in the centralized structure of cloud storage. Contrast this with the decentralized structure of blockchain technology and you begin to appreciate the force behind the sudden price spike in cryptocurrencies that we highlighted above.

Even though security tools and protocols are designed to separate customers date, the recently discovered Meltdown and Spectre flaws still leave serious vulnerabilities.

Meltdown, hackers could rent space on a cloud service, just like any other business customer. Once they were on the service, the flaw would allow them to grab information like passwords from other customers.

Secondly, reports on cloud services like Amazon, Google and Microsoft claim that it creates as much as 30% slower computation speeds. That clearly won’t make for happy customers.

Jerky NetFlix

Virtually everyone reviewing the situation believes individual computer users are the least vulnerable. That may be true. Hackers are in the hunt for the biggest prize and that would be the big three cloud companies. But how do you think families are going to react if their Netflix stalls and buffers every few minutes?

In the final analysis, the Meltdown flaw affects virtually every computer chip fabricated by Intel in use today. You are talking about 90% of the Internet and business world. But Meltdown is just one flaw.

Spectre is the other flaw and this one is the more insidious of the two. There is no known fix. Intel, AMD and others have claimed how complex a project it would be for hackers to breech the Spectre vulnerability. That is pretty hollow comfort. After all, hasn’t the FBI security been breeched. Those guys were supposed to be airtight.

Boom Days For Blockchain

In so many ways, last year marked a tipping point in the spread and acceptance of blockchain technology. The uses for Bitcoin are probably best gauged by its record $20,000 price in December. For Ethereum, it may have been marked by the formation of the Enterprise Ethereum Alliance (EEA) in February and rise to over 300 members at year-end.

No sooner has 2018 begun that the Meltdown and Spectre flaws created unexpected excitement for investors in cryptocurrencies. If I were a software salesman out of work, I would be sending my resume to every crypto company offering to peddle their blockchain. It could be the easiest job since selling web design services in 1995.

The Ethereum platform with its smart contracts is not the only crypto capable of addressing this newly uncovered opportunity created by Meltdown and Spectre. You can safely bet this will attract many players and for good reason, today’s blockchain technology is a long way from fast enough for mass adoption. Blockchain security may be a step or two better in it present form than cloud storage, but it has its security issues as well.

Building the Ethereum Moat

EEA founder Jeremy Millar is clearly a brand ambassador for Ethereum. He believes that CEOs hear the chatter about blockchain and are pre sold not having a clear picture what can be accomplished or the money saved using this technology. The important thing is for IT departments to have a respected brand to attach to their recommendations.

The EEA seeks to connect and inform and through this pioneering process spread the gospel of Ethereum. So far this is beginning to build a brand franchise for Ethereum.

The EEA is the largest blockchain body and is committed to using open-source Ethereum technology for enterprise blockchain solutions. EEA expects to see great advances in these areas in 2018 with Ethereum technologies.

It also helps when Wall Street banks uncover the potential for billions in savings on the trading desks through the applications of the Ethereum platform.

So, if you though the last year held plenty of excitement, the Meltdown and Spectre flaws promise to make this year every bit as much fun.

Featured image courtesy of Shutterstock.

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way. (14 votes, average: 4.14 out of 5)You need to be a registered member to rate this.Loading...

4.4 stars on average, based on 76 rated postsJames Waggoner is a veteran Wall Street analyst and hedge fund manager who has spent the past few years researching the fintech possibilities of cryptocurrencies. He has a special passion for writing about the future of crypto.

The Pirate Bay is Hijacking PCs to Stealth-Mine Cryptocurrency

For the second time in as many months, The Pirate Bay has been caught mining cryptocurrency on your computer without consent. The torrent platform was actually test-driving cryptocurrency mining in your browser – no doubt a lucrative revenue stream.

The Pirates Are At It Again

The Pirate Bay has been caught using software called Coinhive, a JavaScript library that essentially serves as a cryptocurrency miner. It basically connects to visitors’ computers to mine Monero, one of the world’s most profitable cryptocurrencies.

The news was later confirmed by Bleeping Computer, which reported that,”The Pirate Bay, the internet’s largest torrent portal, is back at running a cryptocurrency miner after it previously ran a short test in mid-September.”

Estimates indicate that the scheme has earned the pirates a total of $43,000 over a three-week period.

Users had no way to opt their computers out of being test-driven by the torrent network. Back in September, The Pirate Bay got away by telling people it was just a test. The site’s owners cannot use the same excuse this time around.

CoinHive advises websites to let their visitors know their browser is being used to mine cryptocurrency.

“We’re a bit saddened to see that some of our customers integrate CoinHive into their pages without disclosing to their users what’s going on, let alone asking for their permission,” the company said.

The good news is most ad-blockers and antivirus programs will block CoinHive, given its recent abuses. That means not all visitors of The Pirate Pay were being used as a conduit for mining Monero.

Monero Joins Global Crypto Rally

The value of Monero (XMR) shot up nearly 8% on Friday, and was last seen trading at $94.17. With more than 15.2 million XMR tokens in circulation, the total market cap for Monero is $1.4 billion, according to CoinMarketCap. That’s enough for ninth on the global cryptocurrency list.

Twelve cryptos have now crossed the $1 billion valuation mark. A handful of others have made their way north of $500 million.

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way. (0 votes, average: 0.00 out of 5)You need to be a registered member to rate this.Loading...

4.5 stars on average, based on 410 rated postsSam Bourgi is Chief Editor to Hacked.com, where he specializes in cryptocurrency, economics and the broader financial markets. Sam has nearly eight years of progressive experience as an analyst, writer and financial market commentator where he has contributed to the world's foremost newscasts.

A part of CCN

Hacked.com is Neutral and Unbiased

Hacked.com and its team members have pledged to reject any form of advertisement or sponsorships from 3rd parties. We will always be neutral and we strive towards a fully unbiased view on all topics. Whenever an author has a conflicting interest, that should be clearly stated in the post itself with a disclaimer. If you suspect that one of our team members are biased, please notify me immediately at jonas.borchgrevink(at)hacked.com.